Prior authorization is the requirement that a health care provider seek approval of a drug, procedure, or test before receiving reimbursement from a health carrier. Health carriers may impose different prior authorization standards and criteria for a covered service among tiers of contracting providers. In 2023, the Legislature passed HB 1357, establishing timeframes for standard and expedited prior authorization requests for health plans offered by health carriers, health plans offered to public or school employees, retirees, and their dependents, and Medicaid coverage offered through managed care organizations. 

Health carriers, health plans, and managed care organizations must describe their prior authorization requirements in detailed, easily understandable language. Health carriers, health plans, and managed care organizations must make the most current prior authorization requirements and restrictions available upon request in an electronic format. The prior authorization requirements must be based on peer-reviewed, evidence-based clinical review criteria which is evaluated and updated at least annually. The clinical review criteria must accommodate new and emerging information related to the appropriateness of clinical criteria with respect to Black and indigenous people, other people of color, gender, and underserved populations.

Health carriers, health plans, and managed care organizations must build and maintain a prior authorization application programming interface that automates the process for determining the necessity for a prior authorization, identifying information and documentation requirements, and facilitating the exchange of prior authorization requests and determinations. The application programming interface must use Health Level 7 Fast Healthcare Interoperability Resources, automate the prior authorization determination process, allow providers to query prior authorization documentation requirements, support automated compiling and exchange of necessary data elements to populate the prior authorization requirements, and indicate that prior authorization denials or authorizations of less intensive services are adverse benefit determinations subject to grievance and appeal processes. As an alternative to using an application programming interface, health carriers, health plans, and managed care organizations may establish an interoperable electronic process for prior authorizations related to prescription drugs. 

The application programming interface must support prior authorization requests and determinations for health care services beginning January 1, 2025, and for prescription drugs beginning January 1, 2027. If federal regulations on the application programming interface standards are not finalized by September 13, 2023, the commencement date for standards related to health care services will be delayed until January 1, 2026.

By October 1, 2020, and annually thereafter, for individual and group health plans issued by a carrier that has written at least 1 percent of the total accident and health insurance premiums written by all companies authorized to offer accident and health insurance in Washington in the most recently available year, the carrier must report to the Office of the Insurance Commissioner certain prior authorization data for the prior plan year related to procedures and services with the highest number of requests, approvals, and denials. 

Prior Authorization Requirements. When issuing a notification for a prior authorization determination, the carrier, health plan, or managed care organization, and contracted health care benefit managers must provide the credentials, board certifications, and areas of specialty expertise and training of the provider who had clinical oversight over the determination in any notification sent to the health plan enrollee and provider requesting or referring the service.

Carriers, health plans, and managed care organizations may make adjustments to policies and procedures that impact the applicability of their prior authorization requirements. Beginning August 1, 2025, new application of prior authorization for health care services or prescription drugs can only be made quarterly and go into effect either January 1st, April 1st,  July 1st, or October 1st of any given calendar year. Notification of policy changes must be provided to all in-network providers at least 45 days prior to the quarterly update and must be available to providers on the electronic prior authorization system or application programming interface system. Until January 1, 2028, this information must also be provided in a single location on the carrier's website. The notification must be provided independent of other policy changes or provider notification publications and be easily accessible in electronic provider and enrollee portals.

Adjustments to policies and procedures that impact the applicability of prior authorization requirements to reflect new evidence for health care services or prescription drugs including nationally recognized standards of care that are publicly available, consensus guidelines of nonprofit health care provider professional associations, nationally recognized clinical practice guidelines that are publicly available, guidelines or recommendations of federal government agencies including federal Food and Drug Administration approvals, or state or national public health emergencies may be made at any time.

Artificial Intelligence.  A determination of medical necessity shall be made only by a licensed physician or a licensed health professional working within their scope of practice. The licensed physician or licensed health professional shall evaluate the specific clinical issues involved in the health care services requested by the requesting provider by reviewing and considering the requesting provider's recommendation, the enrollee's medical or other clinical history, as applicable, and individual clinical circumstances. Artificial intelligence shall not be the sole means used to deny, delay, or modify health care services. Algorithms may be used to process and approve prior authorization requests, but may not be used without human review to deny care based on a determination of medical necessity.

A carrier, health plan, or managed care organization and any contracted health care benefit manager that uses artificial intelligence for the purpose of prior authorization or prior authorization functions, based in whole or in part on medical necessity, or that contracts with or otherwise works through a third party for these purposes, shall ensure all of the following: 

• the artificial intelligence bases its determination on the following information, as applicable:
  1. an enrollee's medical or other clinical history;
  2. individual clinical circumstances as presented by the requesting provider; and
  3. other relevant clinical information contained in the enrollee's medical or other clinical record; 
• the artificial intelligence does not base its determination solely on a group data set;
• the artificial intelligence criteria and guidelines complies with this act and applicable state and federal law;
• the use of artificial intelligence does not discriminate, directly or indirectly, against an enrollee in violation of state or federal law;
• the artificial intelligence is fairly and equitably applied, including in accordance with any applicable regulations and guidance issued by the federal Department of Health and Human Services;
• the policies and procedures for using artificial intelligence is open to audit by the Office of the Insurance Commissioner;
• the artificial intelligence performance, use, and outcomes are periodically reviewed to maximize accuracy and reliability; and
• patient data is not used beyond its intended and stated purpose, consistent with state and federal law. 

Carrier Retrospective Denials. Carriers shall not retrospectively deny coverage or retrospectively modify to a service less intensive than that included in the original request for emergency and nonemergency care that had prior authorization, including for medical necessity, under the plan's written policies at the time the care was rendered, unless the prior authorization was based upon a material misrepresentation by the provider, facility, or covered person or the underlying health plan coverage is lawfully rescinded, canceled, or terminated retrospectively through the date of service.  

Retrospective denials of services with prior authorization or retrospective modification to less intensive services due to a change in the carrier's determination of medical necessity are prohibited, shall not be considered adverse benefit determinations, and will not be required to follow the standard appeals processes.

Reporting Requirements. By January 1, 2026, managed care organizations must submit the total number of prior authorization requests, approvals, and denials to the Health Care Authority (HCA) on a quarterly basis. Managed care organizations shall report these totals by health plan and for each health care benefit manager that is delegated to provide care determinations on behalf of the managed care organization. Managed care organizations shall indicate the percentage of total denials that were aided by artificial intelligence tools and algorithms and the percent of care determinations that do not meet the emergent and nonemergent authorization request turnaround times. HCA shall provide a reporting template to managed care organizations 90 days prior to the first report submission and shall review the template annually for updates. HCA shall publish on its website the results of each managed care organization's report 45 days after submission, along with their own prior authorization statistics for fee-for-service Medicaid enrollees. 

By July 1, 2027, HCA shall determine which treatments, prescription drugs, and services, along with their applicable billing codes, do not require prior authorization by managed care organizations. HCA must consider applicable state and federal program integrity regulations when deciding which services they will waive prior authorization requirements. 

Beginning January 1, 2026, carriers also report the total number of prior authorization requests, approvals, and denials made in that time. The carrier must report these totals by both health plan and each health care benefit manager that is delegated to provide care determinations on behalf of the carrier. In the report, carriers must also indicate the percentage of total denials that were aided by artificial intelligence and the percent of care determinations made after the required emergent and nonemergent authorization request turnaround times.

• Removes the requirement that when issuing a notification for a prior authorization determination, a carrier, managed care organization, or health plan must provide a unique identifier for the individual who made the determination and the national provider identification number of the physician who had clinical oversight.
• Requires carriers, managed care organizations, and health plans to include specified information regarding the provider who had clinical oversight when denying a prior authorization determination.
• Removes the requirement that a carrier, managed care organization, or health plan must make a peer-to-peer review discussion available to a requesting provider in the case of an adverse benefit determination.
• Requires carriers, managed care organizations, and health plans to only make changes to prior authorization requirements quarterly, instead of annually, and requires notification of such changes 45 days in advance, instead of four months in advance, unless an exception applies.
• Requires changes to prior authorization requirements to be made available on an electronic prior authorization system and until January 1, 2028, on a single location on a carrier's, managed care organization's, or health plan's website.
• Establishes an exception to the requirement regarding the frequency with which changes to prior authorization policies may be made for changes that are made to reflect nationally recognized standards of care that are publicly available, consensus guidelines of nonprofit health care provider professional associations, nationally recognized clinical practice guidelines that are publicly available, guidelines or recommendations of federal government agencies including federal Food and Drug Administration approvals, or public health emergencies.
• Allows carriers to remove requirements at any time.
• Changes references to an "artificial intelligence, algorithm, or related software tool" to  "artificial intelligence."
• Modifies the definition of "artificial intelligence" by removing a reference to the ability of the technology to forecast future outcomes and by specifying that "artificial intelligence" includes "generative artificial intelligence."
• Establishes that algorithms may be used to process and approve prior authorization requests, but may not be used without human review to deny care based on a determination of medical necessity.
• Specifies that requirements relating to prior authorization determinations apply to health care benefit managers under direct or indirect contract with a carrier, managed care organization, or health plan.
• Specifies that OIC and HCA may adopt rules necessary to implement requirements relating to prior authorization determinations.
• Expands requirements relating to the Authority's review of treatments, prescription drugs, and services that do not require prior authorization by requiring the Authority to publish a list of treatments, prescription drugs, equipment, and services that specifies under which circumstances prior authorization is required or prohibited for Medicaid.
• Modifies language related to prior authorization reporting to OIC.

The committee recommended a different version of the bill than what was heard. PRO: Prior authorization decisions should be made by health professionals and based on the specific circumstances of the patient. Prior authorization affects many services and products, and this bill would increase transparency. A peer to peer process will expedite the prior authorization process. Prior authorization denials increasing due to AI. Retroactive denials undermine the trust in the process.

CON: Data does not suggest use of AI for prior authorization denials. Unique identifiers in prior authorization decisions compromises safety of those making the decisions. Limiting prior authorization criteria updates prevents updating evolving research, delays care and limits access. 

PRO: Senator Tina Orwall, Prime Sponsor; Dr. Addison Stone, Proliance Surgeons; Vanessa Saavedra, Northwest Health Law Advocates; Dr. Douglas Backous; Lisa Thatcher, Washington State Hospital Association; Adam Dittemore, EvergreenHealth; Rena Cardenas, MultiCare Health System; Katina Rue, DO, WA State Medical Assn; Malorie Toman, WA State Medical Assn.